### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 17, 2022, 4:37pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/1 "2022-08-17T16:37:55Z")
Hi all,
I set up an elasticsearch's cluster with 3 nodes. I deploy the first one e installed after kibana in the same VM(RHEL).
It's work ok. With Xpack-security enable.
elasticsearch.yml:
Added other 2 nodes using enrolment token.
Everything is ok.
When I set up logstash and try connect to elasticsearch I saw this error:
Telnet to elasticsearch on port 9200 work well.
## Basic Security Logstash
Created role logstash\_writer e logstash\_read e logstash\_internal's user that [elastic.co](http://elastic.co) recommend, howerver still don't work.
I believe one error in elasticsearch, because metricbeat didn't work too.
I didn't change any thing in logstash.yml.
Follow file .conf that I used:
Regards,
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [August 17, 2022, 5:58pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/2 "2022-08-17T17:58:09Z")
can you execute
`curl -u user:pass -XGET "http://:9200/_cluster/health?pretty`
use same username password you trying on logstash?
how about use user elastic?
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 17, 2022, 6:55pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/3 "2022-08-17T18:55:53Z")
Show this error: curl:(52) Empty reply from server.
Inside Kibana woring well.
I don't see any problem to use elastic. I am using logstash\_internal because I followed elastic procedure.
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 17, 2022, 8:27pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/4 "2022-08-17T20:27:56Z")
Have you tried with https ? You have tls enabled, but you are communicating to elasticsearch using http.
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 17, 2022, 8:42pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/5 "2022-08-17T20:42:19Z")
@Ugo_Sangiorgi still don't working.
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 17, 2022, 8:43pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/6 "2022-08-17T20:43:07Z")
I need create a self certificated ? How I do it ?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [August 17, 2022, 8:53pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/7 "2022-08-17T20:53:20Z")
[https://discuss.elastic.co/t/how-to-replace-security-certificate-sign-by-elastic-ca/302840](https://discuss.elastic.co/t/how-to-replace-security-certificate-sign-by-elastic-ca/302840)
Check this out
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 17, 2022, 8:54pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/8 "2022-08-17T20:54:45Z")
1. your ES uses a self signed certificate, so your curl must include "-k" for insecure
2. check your installation, you will find a file called "http\_ca.crt" under elasticsearch-/config/certs
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 19, 2022, 6:00pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/9 "2022-08-19T18:00:09Z")
@Ugo_Sangiorgi @elasticforme
I have created CA without password. After that set up my elasticsearch.yml with xpack security enable and redefine transport.ssl path.
However elasticsearch didn't start because this error:
When I made yum install in the final show me elastic password:
I tried the same procedure passing this password but didn't work too.
Without security cluster work well.
Is there something that I make wrong ?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [August 21, 2022, 9:23pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/10 "2022-08-21T21:23:03Z")
When I create cluster I do execute this command before doing anything and setup my password.
then restart cluster with adding my ssl files in config etc..
`/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive`
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 21, 2022, 11:26pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/11 "2022-08-21T23:26:09Z")
@elasticforme
I use these password when I will create CA and certificate ? Or still use empty password ?
Regards,
Silas Muniz
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [August 22, 2022, 2:07am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/12 "2022-08-22T02:07:36Z")
that password and certificate is two different thing.
certificate is used to communicate with other node in cluster
I know it is hard to get head around it if you doing first time security thing. as it happened to me.
you have already created cluster and has these lines in your elasticsearch.yml file then you are already using certificate. something like this
```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/config/elastic-certificates.p12
```
now you are using some use logstash\_internal but I don't know what role you have for it.
first use user elastic and see it it work.
if does then it is user grant problem.
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 31, 2022, 7:01pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/13 "2022-08-31T19:01:23Z")
@elasticforme
First of all, thank you for you help.
I use elastic credential in logstash but not work. Kibana accpeted elastic credential for authentication.
What's I do wrong ?
I have seen this error in logstash:
\< [INFO] 2022-08-31 15:09:25.218 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=\>"192.168.0.35:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\}
[WARN] 2022-08-31 15:09:25.219 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic:xxxxxx@192.168.0.35:9200/](http://elastic:xxxxxx@192.168.0.35:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://192.168.0.35:9200/](http://192.168.0.35:9200/)][Manticore::ClientProtocolException] 192.168.0.35:9200 failed to respond"} /\>
I used /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic to change elastic password.
Regards
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [August 31, 2022, 7:04pm UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/14 "2022-08-31T19:04:11Z")
@Ugo_Sangiorgi @elasticforme
curl -u elastic:kKq46rm5q_wkj_wkNiTd -XGET "[https://localhost:9200/\_cluster/health?pretty](https://localhost:9200/_cluster/health?pretty)" -k
{
"cluster\_name" : "my-application",
"status" : "green",
"timed\_out" : false,
"number\_of\_nodes" : 1,
"number\_of\_data\_nodes" : 1,
"active\_primary\_shards" : 16,
"active\_shards" : 16,
"relocating\_shards" : 0,
"initializing\_shards" : 0,
"unassigned\_shards" : 0,
"delayed\_unassigned\_shards" : 0,
"number\_of\_pending\_tasks" : 0,
"number\_of\_in\_flight\_fetch" : 0,
"task\_max\_waiting\_in\_queue\_millis" : 0,
"active\_shards\_percent\_as\_number" : 100.0
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [September 1, 2022, 1:50am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/15 "2022-09-01T01:50:53Z")
your curl for cluster health works that means user/password is connecting to elasticsearch.
error before is showing something different. it has IP address 192.168.0.35 while you testing curl with localhost
---
### Author:  [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)
#### Post date: [September 1, 2022, 10:15am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/16 "2022-09-01T10:15:12Z")
@elasticforme
The error is the same, only change is that in the top a use a production enviroment(ip 172.20.6.206) and the last post I am using the lab enviroment(192.68.0.35).
Logstash =\> 192.168.0.39
Elasticsearch =\> 192.168.0.35
I try implement security in my stack because a need use observality for use alert of my logs.
I want create a rule to analyse my logs and send it for other server. For instance, when um rule reached a condition this log will send to other server(SIEM for example).
Regards
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [September 1, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/17 "2022-09-01T11:36:39Z")
Hello everyone,
Silas you need to understand that if you implement ssl your instances will use the "https" instead of "http" this could mean a lot of things but first you have to switch your configuration to use "https"
> [@SilasMuniz1](#):
>
> Elasticsearch Unreachable: [[http://192.168.0.35:9200/](http://192.168.0.35:9200/)]
Elasticsearch will not answer you on HTTP ! please use **HTTPS**
You also need to ensure **connectivity between logstash and elastic** that's why doing the curl request from **localhost** is useless unless you just try the syntax of the command.
Please perform a request from logstash to elastic with curl.
You can also use this bash tricks which check if the port is open at the TCP level :
```auto
echo > /dev/tcp/ELASTIC_IP/9200 && echo "OK"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2022, 11:37am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311/18 "2022-09-29T11:37:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.